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MEMORANDUM  FOR  ASSISTANT  SECRETARY  OF  DEFENSE 

(HEALTH  AFFAIRS) 

SUBJECT:  TR1CARE  Controls  Over  Claims  Prepared  by  Third-Party  Billing  Agencies 
(Report  No.  D-2009-037) 


We  are  providing  this  report  for  your  information  and  use.  We  considered  management 
comments  on  a  draft  of  the  report  when  preparing  the  final  report. 

Comments  on  the  draft  of  this  report  conformed  to  the  requirements  of  DoD  Directive 
7650.3  and  left  no  unresolved  issues.  Therefore,  no  additional  comments  are  required. 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at  (703) 
604-8866  (DSN  664-8866).  If  you  desire,  we  will  provide  a  formal  briefing  on  the 
results. 


teph  R.  Oliva,  CPA 
(AssMant  Inspector  General 
Xeadjness,  Operations,  and  Support 
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Results  in  Brief:  TRICARE  Controls  Over 
Claims  Prepared  by  Third-Party  Billing 
Agencies 


What  We  Did 

In  2006,  we  reported  on  controls  over 
TRICARE  payments  made  to  overseas  health 
care  providers.  We  identified  a  billing  agency 
in  the  Philippines  that  submitted  false  claims 
and  was  eventually  convicted  by  the  U.S. 
Attorney’s  Office  for  receiving  fraudulent 
payments  totaling  about  $100  million. 

We  performed  this  audit  to  detennine  whether 
similar  weaknesses  existed  within  TRICARE  in 
the  United  States.  Centers  for  Medicare  and 
Medicaid  and  Department  of  Health  and  Human 
Services  have  identified  problems  with  billing 
agencies  in  the  United  States  and  have 
developed  regulations  to  deter  future  fraud  by 
these  agencies.  The  objective  of  the  audit  was 
to  evaluate  the  adequacy  of  TRICARE  controls 
over  payments  for  health  care  claims  prepared 
by  billing  agencies  for  care  provided  in  the 
United  States. 

What  We  Found 

The  TRICARE  Management  Activity  needs  to 
improve  controls  over  payments  for  health  care 
claims  prepared  by  billing  agencies  for  care 
provided  in  the  United  States.  Contrary  to  the 
Federal  regulations  and  the  TRICARE 
Operations  Manual,  the  TRICARE  Management 
Activity  sent  payments  to  billing  agencies  rather 
than  to  providers  and  also  paid  claims  prepared 
by  billing  agencies  that  were  excluded  by  the 
Department  of  Health  and  Human  Services  from 
participating  in  Federal  health  care  programs. 

The  TRICARE  Management  Activity  made 
these  payments  because  it  did  not  identify 
relationships  between  providers  and  billing 


agencies,  and  when  sending  payments,  it  used 
the  billing  agency’s  address  instead  of  the 
provider’s  address.  Further,  TRICARE 
Management  Activity  officials  believed  they 
lack  the  authority  to  exclude  billing  agencies 
that  are  involved  in  preparing  or  submitting 
improper  health  care  claims. 

What  We  Recommend 

We  recommend  that  the  Director,  TRICARE 
Management  Activity  strengthen  controls  by: 

•  identifying  relationships  between 
providers  and  billing  agencies, 

•  ensuring  that  provider  addresses  are  not 
those  of  billing  agencies,  and 

•  initiating  action  to  obtain  the  statutory  or 
regulatory  authority  to  sanction  billing 
agencies  or  any  entities  that  prepare  or 
submit  improper  health  care  claims  to 
the  TRICARE  contractors. 

Implementing  these  controls  should  reduce  the 
likelihood  of  improper  payments. 

Client  Comments  and  Our 
Response 

The  Assistant  Secretary  of  Defense  (Health 
Affairs)  comments  were  responsive  to  the 
recommendations  and  no  further  comments  are 
required.  See  recommendations  table  on  page 
ii. 
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Introduction 

Background 

The  TRICARE  Management  Activity  (TMA)  is  responsible  for  managing  TRICARE,  the 
DoD  health  care  program  for  active  duty  and  retired  service  members  and  their 
dependents.  TMA  oversees  the  contractors  responsible  for  delivering  benefits  throughout 
three  regions  (North,  South,  and  West)  within  the  United  States  and  establishes 
guidelines  for  claims  processing.  As  of  January  2008,  these  TRICARE  contractors  paid 
about  $7.2  billion  in  FY  2007  for  care  provided  within  the  United  States. 

Health  care  providers  may  submit  claims  directly  to  a  TRICARE  contractor  or  through 
other  organizations,  such  as  third-party  billing  agencies  or  clearinghouses.  Providers 
using  billing  agencies  must  furnish  patient  and  service  infonnation  to  the  billing 
agencies,  who  then  submit  claims  directly  to  the  TRICARE  contractors  or  through  a 
clearinghouse  for  processing.  Clearinghouses  electronically  format  the  claims  prepared 
by  providers  or  billing  agencies  and  submit  them  to  the  TRICARE  contractors  for 
payment.  According  to  the  Healthcare  Billing  &  Management  Association,  billing 
agencies  process  more  than  200  million  claims  for  about  $18  billion  a  year.1 

Federal  Concerns  About  Billing  Agencies 

In  February  2006,  DoD  Inspector  General  Report  No.  D-2006-051,  “TRICARE  Overseas 
Controls  Over  Third  Party  Billing  Agencies  and  Supplemental  Health  Insurance  Plans,” 
reported  on  health  care  claim  payments  to  billing  agencies  for  care  provided  overseas. 

The  report  showed  that  a  billing  agency  in  the  Philippines  submitted  inflated  charges  and 
received  payment  directly  from  TRICARE.  This  billing  agency  was  eventually  convicted 
by  the  U.S.  Attorney’s  Office  for  receiving  fraudulent  payments  totaling  about 
$100  million.  To  reduce  the  likelihood  of  improper  payments  for  claims  submitted  by 
billing  agencies  for  care  provided  overseas,  we  recommended  that  TMA  stop  sending 
payments  to  billing  agencies.  These  billing  improprieties  led  us  to  question  whether 
similar  activities  were  occurring  within  the  United  States. 

The  Department  of  Health  and  Human  Services  (HHS)  works  closely  with  State  and  local 
governments  to  protect  the  health  of  all  Americans  and  provide  essential  human  services 
through  Medicare.  The  Centers  for  Medicare  and  Medicaid  Services  (CMS)2  is 
responsible  for  managing  Medicare.  More  and  more,  providers  are  relying  on  billing 
agencies  to  process  their  claims  in  accordance  with  Federal  and  State  laws.  As  a  result, 
the  HHS  Office  of  Inspector  General  (OIG)  has  issued  guidance  to  assist  billing  agencies 
in  developing  internal  controls  that  adhere  to  existing  claims  processing  and 
reimbursement  laws. 


1  Healthcare  Billing  &  Management  Association  is  a  trade  association  representing  third-party  billing 
agencies. 

2  Formerly  the  Health  Care  Financing  Administration. 
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In  testimony,  an  HHS  OIG  official  stated  “the  problems  associated  with  dishonest 
third-party  billing  companies  are  as  old  as  the  Medicare  program  itself.”3  Additionally,  a 
CMS  official  testified  that  CMS’  ability  to  detect  such  abuses  was  limited  because  it  did 
not  have  a  “direct  business  relationship”  with  billing  agencies.4  According  to 
Government  Accountability  Office  (GAO),  identifying  fraud  committed  by  billing 
agencies  is  like  detecting  needles  in  a  haystack;  however,  if  program  officials  can  link 
providers  to  problematic  billing  agencies,  this  will  give  them  a  magnet  to  detect  the 
needles.5 

In  an  attempt  to  mitigate  this  problem,  CMS  issued  a  new  enrollment  form  in  May  1996 
that  required  detailed  information  from  all  providers  regarding  which  billing  agency  they 
use,  if  any  (see  Appendix  B),  and  CMS  stores  this  infonnation  electronically.  According 
to  a  CMS  official,  CMS  requires  all  providers  to  revalidate  their  enrollment  infonnation 
periodically  and  to  notify  the  claims  contractor  within  30  days  of  any  changes  in 
enrollment  information. 

An  HHS  OIG  official  testified  that  sending  payments  to  billing  agencies  could  result  in 
undetected  fraudulent  claims  for  services  billed  but  not  rendered  because  the  provider 
would  be  unaware  of  the  false  claims  being  submitted/  The  volume  of  claims  prepared 
by  billing  agencies  and  the  amount  of  beneficiary  and  provider  infonnation  they  maintain 
could  allow  them  to  bill  for  improper  charges.  Over  the  years,  HHS  OIG  and  DoD  OIG 
officials  identified  several  cases  of  billing  agency  fraud  or  abuse  that  impacted  Medicare 
and  TRICARE.  See  Appendix  C  for  a  listing  and  description  of  some  of  those  cases. 

Standardization  of  TRICARE  and  Medicare  Claims 

The  National  Defense  Authorization  Act  for  Fiscal  Year  2007  (Defense  Authorization 
Act)  requires  standardization  of  claims  processing  between  TRICARE  and  Medicare.6 
The  Defense  Authorization  Act  requires  the  Secretary  of  Defense  to  submit  an  annual 
report  listing  the  differences  found  between  the  two  programs  and  justifications  for  each. 
According  to  the  Secretary’s  October  2007  report,  DoD  performed  a  comprehensive 
assessment  of  the  TRICARE  claims  processing  requirements  from  the  point  at  which 
services  were  rendered  to  the  time  the  claim  was  paid  or  denied  and  compared  each  stage 
to  the  claims  processing  requirements  of  Medicare.  The  report  identified  seven 
differences  in  claims  processing,  none  of  which  were  related  to  billing  agencies. 

TMA  officials  believe  the  Defense  Authorization  Act  is  not  applicable  because 
identifying  and  paying  billing  agencies  is  not  a  claims  processing  issue.  In  our  opinion, 
however,  this  falls  within  the  scope  of  claims  processing  as  identified  in  DoD’s 
comprehensive  assessment.  Moreover,  CMS  includes  guidance  on  paying  billing 
agencies  in  its  “Medicare  Claims  Processing  Manual.” 


3  Testimony  before  the  House  Committee  on  Commerce,  Subcommittee  on  Oversight  and  Investigations, 
April  6,  2000  Statement  of  Lewis  Morris,  HHS  Assistant  Inspector  General  for  Legal  Affairs. 

4  Testimony  April  6,  2000,  Statement  of  Penny  Thompson,  CMS  Program  Integrity  Director. 

5  GAO/T-HEHS-OO-93. 

6  Section  731,  “Standardization  of  Claims  Processing  Under  TRICARE  Program  and  Medicare  Program.” 
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Identification  of  Billing  Agencies 

Throughout  the  audit,  we  attempted  to  identify  billing  agency-related  claims,  but  TMA 
does  not  maintain  such  data.  As  a  result,  we  were  unable  to  detennine  the  total  amount 
of  TRICARE  claims  prepared  by  billing  agencies.  Without  this  infonnation,  we  could 
not  identify  potentially  fraudulent  billing  patterns  involving  billing  agencies.  However, 
through  contacts  we  made  with  Federal  and  private  health  care  organizations,  we  were 
able  to  identify  several  billing  agencies  that  were  involved  in  submitting  TRICARE 
claims.  We  identified  improper  claims  for  a  provider  that  used  a  billing  agency  and 
issued  a  criminal  referral  to  the  Defense  Criminal  Investigative  Service  regarding  the 
improper  claims. 

Objective 

The  objective  of  the  audit  was  to  evaluate  the  adequacy  of  TRICARE  controls  over 
payments  for  health  care  claims  prepared  by  billing  agencies  for  care  provided  in  the 
United  States.  See  Appendix  A  for  a  discussion  of  the  scope  and  methodology,  review  of 
internal  controls,  and  prior  coverage  related  to  the  objective. 


Review  of  Internal  Controls 

Our  audit  showed  that  TMA  needs  to  strengthen  its  internal  controls  over  claims  prepared 
by  billing  agencies.  Because  we  could  not  quantify  the  total  amount  of  TRICARE  claims 
prepared  by  billing  agencies,  we  were  unable  to  detennine  whether  the  internal  control 
weakness  was  material,  as  defined  by  DoD  Instruction  5010.40,  “Managers’  Internal 
Control  (MIC)  Program  Procedures,”  January  4,  2006.  See  the  Finding  for  an 
explanation  of  the  internal  control  weakness  identified  by  this  audit.  Implementing 
Recommendations  1.,  2.,  and  3.  will  improve  controls  over  claims  prepared  by  billing 
agencies.  We  will  provide  a  copy  of  this  report  to  the  senior  TMA  official  responsible 
for  internal  controls  in  TRICARE. 
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Finding.  Controls  Over  Payments  for  Claims 
Prepared  by  Billing  Agencies 

The  TMA  needs  to  improve  controls  over  payments  for  health  care  claims  prepared  by 
billing  agencies  for  care  provided  in  the  United  States.  TMA  was  sending  payments  to 
billing  agencies  and  paying  claims  prepared  by  billing  agencies  that  HHS  had  excluded. 
TMA  could  strengthen  controls  by  identifying  the  relationships  between  providers  and 
billing  agencies  and  by  ensuring  that  a  billing  agency  address  is  not  shown  as  a  provider 
address.  Further,  TMA  should  initiate  action  to  modify  Federal  regulations  to  give  it  the 
authority  to  exclude  billing  agencies  abusing  or  committing  fraud  against  TRICARE. 
Implementing  additional  controls  over  payments  for  health  care  claims  prepared  by 
billing  agencies  should  help  reduce  the  likelihood  of  improper  payments. 

Payments  for  Billing  Agency  Claims 

Contrary  to  Federal  regulations  and  the  TRICARE  Operations  Manual,  TMA  sent 

TO 

payments  to  billing  agencies.  ’  Additionally,  TMA  paid  claims  prepared  by  billing 
agencies  that  HHS  had  excluded  from  participating  in  a  Federal  health  care  program. 

Payments  Made  to  Billing  Agencies 

TMA  sent  payments  to  billing  agencies.  Federal  regulations  require  that  payments  go  to 
the  beneficiary  or  to  the  provider.  Further,  the  TRICARE  Operations  Manual  states  that 
payments  should  be  made  to  the  providers  even  if  they  use  a  billing  agency.  Similarly, 
CMS  requires  that  Medicare  payments  go  to  providers.  TMA  officials  believed  that  the 
claims  processing  contractors  were  not  sending  payments  to  billing  agencies.  We 
obtained  billing  agency  mailing  address  infonnation  from  private  insurance  contacts,  the 
Internet,  and  claims  data.  Using  the  mailing  address  information,  we  identified  at  least 
$2.1  million  that  TMA  sent  to  three  billing  agencies  in  FYs  2006  and  2007,  as  shown  in 
Table  1. 

Table  1.  TRICARE  Payments  Sent  to  Three  Selected  Billing  Agencies 


Billing  Agency 

No.  of  Claims 

Amount  Paid 

A 

7,215 

$1,374,147.36 

B 

4,382 

562,675.93 

C 

1,650 

206,639.26 

Total 

13,247 

$2,143,462.55 

Note:  Details  will  be  provided  to  TMA  under  separate  cover. 

We  believe  it  is  likely  that  TMA  sent  payments  to  other  billing  agencies  as  well,  but  we 
were  unable  to  quantify  the  magnitude  of  these  payments  because  TMA  does  not  gather 
billing  agency  infonnation  and  cannot  identify  which  claims  were  prepared  by  billing 


7  32  C.F.R.  Section  199.7. 

s  TRICARE  Operations  Manual  6010.51-M,  August  2002. 
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agencies.  Sending  payments  to  billing  agencies  may  increase  the  risk  to  TMA  that  billing 
agencies  are  submitting  fraudulent  claims  without  the  provider’s  knowledge. 

Payments  for  Claims  Prepared  by  HHS-Excluded  Billing 
Agencies 

TMA  paid  claims  prepared  by  billing  agencies  that  HHS  had  excluded.  HHS  has  the 
authority  to  exclude  individuals  and  entities  from  participation  in  any  Federal  health  care 
program.9  HHS  maintains  information  in  a  database  called  the  “List  of  Excluded 
Individuals/Entities,”  which  is  available  to  the  public,  providers,  beneficiaries,  and  other 
agencies.  TMA  obtains  a  copy  of  this  list  monthly  and  forwards  it  to  the  TRICARE 
contractors  for  file  updates  and  implementation.  Because  TMA  did  not  verify  provider 
versus  billing  agency  addresses  and  because  the  TRICARE  Purchased  Care  Detail 
Information  System  does  not  identify  billing  agencies  or  the  claims  they  prepare,  TMA 
could  not  identify  the  HHS-excluded  billing  agencies  within  its  databases  and  prevent 
payments  to  these  entities,  as  required  by  law.9 

We  searched  the  HHS  Exclusion  Program  Web  site  and  found  101  excluded  billing 
agencies  as  of  January  2008.  We  matched  the  mailing  addresses  of  the  HHS-excluded 
billing  agencies  to  the  TRICARE  claims  database  and  saw  that  payments  were  sent  to  the 
addresses  of  three  billing  agencies,  totaling  about  $20,000,  after  the  HHS  exclusion  date. 
Additionally,  TMA  sent  $95,000  to  an  address  similar  to  that  of  another  billing  agency. 
However,  we  were  unable  to  determine  whether  the  payments  actually  went  to  the  billing 
agency  because,  for  those  claims,  the  database  did  not  include  a  suite  number  and  the 
building  had  other  occupants,  possibly  including  providers.  Because  TMA  is  unable  to 
identify  billing  agencies  and  the  claims  they  prepare,  it  may  have  sent  payments  to 
additional  excluded  agencies.  HHS  continues  to  identify  problems  with  billing  agencies 
as  evidenced  by  the  fact  that  the  number  of  billing  agency  exclusions  has  risen,  and  as  of 
July  2008,  there  were  113  billing  agencies  on  the  HHS  exclusion  list. 

Identification  of  Billing  Agencies 

TMA  could  improve  its  internal  controls  by  identifying  provider  and  billing  agency 
relationships  and  ensuring  that  billing  agency  addresses  are  not  shown  as  provider 
addresses.  Implementing  these  internal  controls  should  help  ensure  that  TMA  does  not 
send  claim  payments  to  billing  agencies  or  pay  claims  prepared  by  HHS-excluded  billing 
agencies.  In  an  effort  to  identify  provider  and  billing  agency  relationships,  CMS  officials 
collect  billing  agency  name  and  address  information  during  the  provider  certification 
process  using  CMS  Fonn  855,  “Medicare  Enrollment  Application”  (see  Appendix  B). 
Although  the  Defense  Authorization  Act  requires  standardization  of  claims  processing 
between  TRICARE  and  Medicare,  TMA  does  not  collect  this  information. 

Provider-Billing  Agency  Relationships 

Similar  to  CMS  procedures,  TMA  could  improve  controls  by  gathering  billing  agency 
information  during  the  provider  certification  and  credentialing  process.  Any  entity  that 


9  Section  1128  of  the  Social  Security  Act  (42  U.S.C.  1320a-7). 
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provides  health  care  services  to  TRICARE  beneficiaries  must  be  certified  by  the  State. 
TMA  accepts  two  groups  of  providers:  nonnetwork  and  network.  Nonnetwork  providers 
must  pass  the  State  certification  process  and  must  complete  a  provider  application. 
Network  providers,  as  part  of  the  TRICARE  credentialing  process,  must  file  a  provider 
agreement  with  the  TRICARE  contractor.  The  agreement  requires  the  provider  to  follow 
certain  terms,  such  as  agreeing  to  negotiated  reimbursement  rates.  Both  nonnetwork 
applications  and  network  agreements  require  that  the  provider  list  its  physical  address  and 
its  billing  address. 

Provider  A ddresses 

TMA  could  ensure  that  billing  agency  addresses  are  not  shown  as  provider  addresses  by 
verifying  the  infonnation  captured  in  the  TRICARE  Purchased  Care  Detail  Information 
System.  This  infonnation  shows  a  physical  address  and  a  billing  (mailing)  address  for 
each  provider,  but  TMA  officials  could  not  determine  whether  the  addresses  belonged  to 
the  provider  or  a  billing  agency.  For  one  of  the  billing  agencies  shown  in  Table  1,  we 
identified  186  provider  IDs  in  the  TRICARE  database  that  listed  a  billing  agency  address 
as  the  provider’s  billing  address.  Further,  for  the  186  provider  IDs,  93  also  had  the 
billing  agency  listed  as  the  provider’s  physical  address.  We  further  detennined  that  8  of 
the  93  provider  IDs  were  for  surgery  centers  or  clinics  that  have  known  physical 
addresses. 

According  to  TMA  guidance  and  contractor  officials,  it  is  acceptable  for  some  providers, 
such  as  anesthesiologists,  to  use  the  billing  agency  address  as  their  physical  and  billing 
address  because  the  providers  work  in  numerous  facilities  and  may  not  have  an  office. 
Regardless  of  the  type  of  provider,  we  believe  TMA  should  not  use  a  billing  agency 
address  for  either  the  provider’s  physical  location  or  billing  address.  The  TRICARE 
Systems  Manual  states  that  anesthesiologists,  radiologists,  and  pathologists  may  use  a 
street  address  or  a  P.O.  Box  as  their  physical  address,  but  there  is  no  mention  of  using  a 
billing  agency  address.10 

Impact  of  Identifying  Relationships  and  Addresses 

Identifying  provider  and  billing  agency  relationships,  and  ensuring  that  a  billing  agency 
address  is  not  shown  as  a  provider  address,  should  help  ensure  that  payments  are  not  sent 
to  billing  agencies  and  payments  are  not  made  for  claims  prepared  by  HHS-excluded 
billing  agencies.  Identifying  the  relationships  should  also  allow  TMA  to  identify  aberrant 
billing  patterns  involving  billing  agencies. 

We  learned  that  a  CMS  contractor  for  program  integrity  formed  a  billing  agency 
workgroup,  which  consisted  of  representatives  from  CMS  as  well  as  CMS  contractors,  to 
learn  more  about  possible  fraud  in  the  electronic  environment.  This  CMS  contractor 
created  a  database  linking  providers  that  had  aberrant  billing  patterns  to  billing  agencies, 
thereby  identifying  25  questionable  billing  agencies  for  which  each  had  at  least 
70  percent  of  its  providers  on  fraud  watch.  By  linking  providers  with  the  suspect  billing 


10  TRICARE  Systems  Manual  7950-1M,  August  2002. 
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agencies,  the  CMS  contractor  could  detennine  the  extent  of  possible  improper  billings 
and  identify  other  providers  whose  claims  should  be  monitored. 

From  its  efforts,  the  billing  agency  workgroup  identified  fraudulent  patterns,  including 
relationships  between  suspect  providers  and  organizations  providing  billing  services 
(billing  agencies  and  clearinghouses).  The  workgroup  also  identified  that  the  providers 
and  billing  agencies  were  submitting  duplicate  claims  and  using  provider  and  beneficiary 
information  to  submit  services  billed  but  not  rendered.  TMA  should  develop  similar 
procedures  to  identify  relationships  between  providers  and  billing  agencies  and  identify 
aberrant  billing  patterns. 

Excluding  Third-Party  Billing  Agencies  From  TRICARE 

TMA  believed  it  lacks  the  authority  to  exclude  billing  agencies  that  are  involved  in 
submitting  improper  health  care  claims.  Federal  regulations  allow  TMA  officials  to 
exclude  providers  when  it  is  in  the  best  interest  of  the  program,1 1  but  do  not  mention 
other  entities,  such  as  billing  agencies,  which  provide  billing  services.  Thus,  TMA 
officials  have  only  held  providers  accountable  for  the  improper  claims.  We  believe  TMA 
should  hold  billing  agencies  accountable  if  they  are  found  to  be  submitting  improper 
health  care  claims.  If  TMA  officials  do  not  believe  they  have  the  authority  to  exclude 
billing  agencies,  they  should  initiate  action  to  obtain  the  statutory  or  regulatory  authority 
to  exclude  billing  agencies  or  any  entities  that  prepare  or  submit  improper  health  care 
claims  to  the  TRICARE  contractors. 

The  GAO  findings  and  CMS  actions  discussed  in  this  report  further  support  the  need  for 
TMA  officials  to  strengthen  controls  over  billing  agencies.  Additionally,  Appendix  C 
shows  a  number  of  criminal  cases  that  have  been  successfully  prosecuted  that  involve 
millions  of  dollars  in  improper  claims  by  billing  agencies,  some  of  which  bill  TRICARE. 
By  being  able  to  identify  relationships  between  providers  and  billing  agencies  and  having 
the  authority  to  exclude  the  latter,  TMA  could  deny  claims  that  are  prepared  by  billing 
agencies  that  have  abused  or  committed  fraud  against  TRICARE. 

Recommendations,  Client  Comments,  and  Our 
Response 

We  recommend  that  the  Director,  TRICARE  Management  Activity  strengthen 
internal  controls  to  avoid  paying  improper  health  care  claims  by: 

1.  Identifying  relationships  between  providers  and  billing  agencies. 

2.  Ensuring  that  provider  addresses  are  not  those  of  billing  agencies. 

3.  Initiating  action  to  obtain  the  statutory  or  regulatory  authority  to  sanction 
billing  agencies  or  any  entities  that  prepare  or  submit  improper  health  care  claims 
to  the  TRICARE  contractors. 


11  32C.F.R.  Section  199.9. 
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Assistant  Secretary  of  Defense  (Health  Affairs)  Comments 

The  Assistant  Secretary  of  Defense  (Health  Affairs)  concurred  with  the  report’s  finding 
that  the  TRICARE  Management  Activity  needed  to  improve  controls  over  payments  for 
health  care  claims  submitted  by  billing  agencies.  The  Assistant  Secretary  stated  that  the 
TRICARE  Management  Activity  will  conduct  a  study  during  the  next  180  days  to 
identify  specific  internal  control  weaknesses  and  the  best  approach  to  strengthen  those 
controls.  The  Assistant  Secretary  of  Defense  also  stated  that  the  TRICARE  Management 
Activity  will  review  the  necessity  of  changing  the  regulatory  authority  to  sanction  billing 
agencies. 

Our  Response 

The  Assistant  Secretary  of  Defense  comments  were  responsive  and  confonn  to 
requirements;  no  additional  comments  are  needed.  However,  we  plan  to  evaluate  the 
results  of  the  Health  Affairs  study  and  the  planned  actions  to  ensure  the  intent  of  the 
recommendations  is  satisfied. 
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Appendix  A.  Scope  and  Methodology 

We  conducted  this  performance  audit  from  January  2008  through  September  2008  in 
accordance  with  generally  accepted  government  auditing  standards.  Those  standards 
require  that  we  plan  and  perform  the  audit  to  obtain  sufficient,  appropriate  evidence  to 
provide  a  reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objectives. 
We  believe  that  the  evidence  obtained  provides  a  reasonable  basis  for  our  finding  and 
conclusions  based  on  our  audit  objectives. 

We  met  with  TMA  personnel  in  Falls  Church,  Virginia,  and  Aurora,  Colorado,  to  gather 
information  regarding  TRICARE  controls  over  health  care  claims  prepared  by  billing 
agencies  for  care  provided  in  the  United  States.  We  met  with  the  TRICARE  North, 

South,  and  West  Regional  Offices.  Additionally,  we  visited  contractors  and 
subcontractors  responsible  for  claims  processing,  including  TriWest,  Wisconsin 
Physicians  Services,  HealthNet,  Palmetto  Government  Benefits  Administration,  and 
Humana  Military  Healthcare  Services,  to  gather  information  related  to  their  roles, 
responsibilities,  and  procedures  for  identifying,  excluding,  certifying,  and  processing 
billing  agency-prepared  claims.  We  also  met  with  Defense  Criminal  Investigative 
Service  officials  in  Valencia  and  San  Diego,  California;  CMS  officials  in  Denver, 
Colorado,  and  San  Francisco  and  Santa  Ana,  California;  HHS  officials  via 
teleconference;  the  District  Attorney’s  Office  in  San  Diego,  California;  and  the 
Department  of  Veterans  Affairs  officials  in  Denver,  Colorado,  to  discuss  their  procedures 
or  findings  regarding  billing  agencies. 

We  reviewed  public  laws,  DoD  policies,  and  TRICARE  regulations  to  identify  the 
procedures  and  requirements  established  for  claim  submissions  and  reimbursements 
using  billing  agencies.  Specifically,  we  reviewed  32  Code  of  Federal  Regulations, 
Sections  199.2  through  199.9,  “Civilian  Health  and  Medical  Program  of  the  Uniformed 
Services;”  the  “Medicare  Claims  Processing  Manual,”  updated  January  25,  2008; 

42  U.S.  Code,  Sections  1320a-7  and  1320c-5;  and  the  TRICARE  Systems  Manual 
7950. 1-M  and  Operations  Manual  6010.5 1-M,  both  dated  August  1,  2002.  We  also 
reviewed  supporting  documentation  provided  by  TMA  officials,  the  TRICARE  claims 
processing  contractors,  and  other  Federal  and  State  entities. 

TMA  could  not  identify  billing  agencies;  thus,  we  used  alternative  means  to  identify 
them.  A  private  health  insurance  contact  notified  us  about  one  billing  agency  potentially 
abusing  a  private  health  insurance  program.  We  provided  the  billing  agency  address  to 
TMA  officials  and  requested  that  they  identify  payments  made  in  FYs  2006  and  2007  to 
providers  having  that  address  as  either  their  physical  or  billing  location.  That  research 
led  us  to  question  three  more  addresses.  We  searched  for  the  three  addresses  on  the 
Internet  and  found  that  two  of  them  belonged  to  other  billing  agencies.  We  requested  that 
TMA  officials  research  the  claims  database  to  identify  payments  made  to  the  addresses  of 
the  two  billing  agencies.  The  results  indicated  that  $2.1  million  in  payments  were  sent 
directly  to  those  three  billing  addresses. 
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To  identify  claims  prepared  by  HHS-excluded  billing  agencies,  we  obtained  the  current 
HHS  “List  of  Excluded  Individuals/Entities”  from  the  Internet  and  matched  the  billing 
agency  addresses  from  that  list  to  the  payment  record  addresses  in  the  TRICARE 
Purchased  Care  Detail  Information  System.  Once  we  determined  the  total  dollar  amounts 
sent  to  those  addresses,  we  sorted  the  data  by  official  exclusion  date  to  determine  the 
number  of  claims  and  dollars  paid,  in  error,  to  each  excluded  billing  agency  after  the 
official  exclusion  date. 

Finally,  by  querying  TRICARE  claims  data  for  providers  that  listed  one  of  the  three 
known  billing  agency  addresses  as  their  own  billing  address,  we  identified  186  providers 
that  had  the  same  billing  address  as  the  billing  agency;  93  of  which  had  the  same  provider 
address  as  the  billing  agency. 

We  could  not  identify  potentially  fraudulent  billing  patterns  because  TMA  did  not 
identify  billing  agencies.  However,  we  identified  improper  claims  submitted  for  a 
provider  that  used  one  of  these  billing  agencies,  and  we  issued  a  criminal  referral  to  the 
Defense  Criminal  Investigative  Service  regarding  these  improper  claims. 

Use  of  Computer-Processed  Data 

We  used  computer-processed  data  to  identify  payments  sent  to  three  billing  agencies  and 
payments  sent  for  claims  prepared  by  three  HHS-excluded  billing  agencies.  We  did  not 
perform  a  formal  reliability  assessment  of  the  computer-processed  data  for  this  project. 
However,  our  work  on  two  prior  reports  (listed  below)  showed  that  data  from  the 
TRICARE  Purchased  Care  Detail  Information  System  were  generally  accurate  and 
sufficient  to  support  the  conclusions  from  the  two  reports.  We  did  not  use  these  data  to 
make  any  statistical  projections,  nor  did  we  attempt  to  determine  materiality  on  the 
claims  referenced. 

Prior  Coverage 

During  the  last  10  years,  the  Government  Accountability  Office  (GAO),  DoD  Inspector 
General  (DoD  IG),  and  Health  and  Human  Services  Office  of  Inspector  General 
(HHS  OIG)  have  issued  eight  reports  discussing  controls  over  billing  agencies. 
Unrestricted  GAO  reports  can  be  accessed  at  www.gao.gov.  Unrestricted  DoD  IG 
reports  can  be  accessed  at  http://www.dodig.mil/audit/reports.  Unrestricted  HHS  IG 
reports  can  be  accessed  at  www.oig.hhs.gov/reports.html. 

GAO 

GAO  Report  No.  T-OSI-OO-15,  “Schemes  to  Defraud  Medicare,  Medicaid,  and  Private 
Health  Care  Insurers,”  July  25,  2000 

GAO  Report  No.  T-HEHS-00-93,  “Concerns  About  HCFA’s  Efforts  to  Prevent  Fraud  by 
Third-Party  Billers,”  April  6,  2000 

GAO  Report  No.  OSI-00-5R,  “Improper  Third-Party  Billing  of  Medicare  by  Behavioral 
Medical  Systems,  Inc.,”  March  30,  2000 
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GAO  Report  No.  OSI-OO-IR,  "Fraud  Schemes  Committed  by  Career  Criminals  and 
Organized  Criminal  Groups  and  Impact  on  Consumers  and  Legitimate  Health  Care 
Providers,”  October  5,  1999 

GAO  Report  No.  HEHS  99-127R,  “Identifying  Third-Party  Billing  Companies 
Submitting  Claims,”  June  2,  1999 

DoD  IG 

DoD  IG  Report  No.  D-2008-045,  “Controls  Over  the  TRICARE  Overseas  Healthcare 
Program,”  February  7,  2008 

DoD  IG  Report  No.  D-2006-051,  “TRICARE  Overseas  Controls  Over  Third  Party 
Billing  Agencies  and  Supplemental  Insurance  Plans,”  February  10,  2006 

HHS  OIG 

HHS  Report  No.  OEI-05-99-00100,  “Medical  Billing  Software  and  Processes  Used  to 
Prepare  Claims,”  March  2000 
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Appendix  B.  CMS  Form  855,  “Medicare 
Enrollment  Application,”  Section  8,  “Billing 
Agency  Information” 


SECTION  8:  BILLING  AGENCY  INFORMATION 


Applicants  that  use  a  billing  agency  must  complete  this  section.  A  billing  agency  is  a  company  or  individual 
that  you  contract  with  to  process  and  submit  your  claims.  If  you  use  a  billing  agency,  you  are  responsible 
for  the  claims  submitted  on  your  behalf. 


O  Check  here  if  this  section  does  not  apply  and  skip  to  Section  12. 


BILLING  AGENCY  NAME  AND  ADDRESS 


If  you  are  changing,  adding,  or  deleting  information,  check  the  applicable  box,  furnish  the  effective  date, 
and  complete  the  appropriate  fields  in  this  section. 


CHECK  ONE 

□  CHANGE 

□  add 

□  DELETE 

DATE  (mm/dd/yyyy) 

Legal  Business/Individual  Name  as  Reporled  to  the  Social  Security  Administration  or  Internal  Revenue  Service 


Tax  Identification  Number  or  Social  Security  Number  {required) 


“Doing  Business  As"  Name  (if  applicable) 


Billing  Agency  Address  Line  l  (Street  Name  and  Number) 


Billing  Agency  Address  Line  2  (Suite.  Room,  etc.) 


City/Town 

State 

ZIP  Code +  4 

Telephone  Number 

Fax  Number  (if  applicable) 

E-mail  Address 

if  applicable) 

SECTION  9:  FOR  FUTURE  USE  (This  Section  Not  Applicable) 


SECTION  10;  FOR  FUTURE  USE  (This  Section  Not  Applicable) 


SECTION  11:  FOR  FUTURE  USE  (This  Section  Not  Applicable) 


CMS  855A  (02/08)  30 
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Appendix  C. 
Irregularities 

Several  Cases  of  Billing  Agency 

Billing  Agency 

Irregularity 

Handle  With  Care,  Inc. 

This  billing  agency  was  identified  in  the  early  1990s  from  a 
criminal  investigation  as  billing  Medicare  for  surgical  dressings 
amounting  to  $7.4  million  for  surgeries  that  never  occurred. 

Professional  Medical 
Billers 

From  1994  to  1996,  the  billing  agency  fabricated  services  on 
providers’  claims  and  submitted  the  claims  to  Federal  health  care 
programs  using  the  providers’  ID  numbers.  The  billing  agency 
reimbursed  the  providers  for  legitimate  charges  and  kept  the 
overpayments. 

Emergency  Physician 
Billing  Service 

In  1999,  the  billing  agency  was  sentenced  for  increasing  client 
reimbursement  10  percent  to  25  percent  by  upcoding  or  filing 
claims  for  a  higher  level  of  service  than  was  actually  delivered. 
This  involved  the  Federal  health  care  programs,  including 

TRIG  ARE.  The  billing  agency  received  payment  based  on  a 
percentage  of  the  revenues  billed  or  recovered,  depending  on  the 
client. 

Behavioral  Medical 
Systems 

In  2000,  the  GAO  reported  that  this  billing  agency  submitted 
claims  to  Medicare  for  services  not  rendered,  which  totaled 
$1.3  million. 

Medaphis 

In  1998,  a  whistleblower  reported  that  this  billing  agency 
submitted  duplicate  claims  with  incorrect  charges  on  behalf  of 
its  client. 

Gottlieb  Financial 
Services,  Inc. 

This  billing  agency  used  a  software  system  that  upcoded 
emergency  room  visits,  resulting  in  a  $  1 5  million  settlement  in 
1999. 

Health  Visions 
Corporation 

In  2006,  DoD  IG  identified  wide-scale  medical  billing 
improprieties  in  the  Philippines  by  a  billing  agency.  The 
company  billed  and  received  payments  from  TRICARE  directly, 
without  the  provider  certifying  that  services  were  performed  and 
accurately  billed,  allowing  it  to  inflate  charges.  The  United 

States  Attorney’s  Office  estimated  billing  improprieties  of  about 
$100  million. 

All-Med  Billing 
Corporation 

In  2007,  a  federal  grand  jury  issued  a  46-count  indictment 
against  the  billing  agency  for  submitting  about  $80  million  in 
false  claims  to  Medicare  on  behalf  of  29  durable  medical 
equipment  companies. 

R  and  I  Medical  Billing, 
Inc. 

In  2007,  the  billing  agency  was  identified  as  submitting  claims 
to  Medicare  for  infusions,  totaling  $170  million.  It  received 
about  5  percent  of  each  reimbursement. 
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Assistant  Secretary  of  Defense  (Health  Affairs)  Comments 


HEALTH  AFFAIRS 


THE  ASSISTANT  SECRETARY  OF  DEFENSE 

1200  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-1  200 


DEC  1 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 
DEPUTY  INSPECTOR  GENERAL  FOR  AUDITING 
DIRECTOR,  MILITARY  HEALTH  SYSTEM  DIVISION 

SUBJECT:  Draft  Report,  “TRICARE  Controls  Over  Claims  Submitted  by  Third  Party 
Billing  Agencies” — Project  Number  D2008-D000LF-0 100,00 

Thank  you  for  the  opportunity  to  review  and  provide  comments  on  the  draft 
report,  “TRICARE  Controls  Over  Claims  Submitted  by  Third  Party  Billing  Agencies” 
(D2008-D000LF-01 00.000). 

I  concur  with  the  report’s  conclusion  that  TRICARE  Management  Activity 
(TMA)  needs  to  improve  controls  over  payments  for  health  care  claims  submitted  by 
billing  agencies.  I  also  agree  with  the  Department  of  Defense  Inspector  General’s 
assessment  of  the  difficulty  of  “linking  providers  to  problematic  billing  agencies.”  As  a 
result,  to  assess  what  actions  are  required  to  strengthen  internal  controls  over  payments  to 
third  party  billing  agencies,  TMA  will  conduct  a  review  during  the  next  180  days. 

My  specific  comments  to  the  draft  report  findings  and  recommendations  are 
attached.  Please  feel  free  to  direct  any  questions  on  this  audit  to  Mr.  Kenneth  Jacobs 
(Functional)  at  (303)  676-3568  or  Mr.  Gunther  J.  Zimmerman  (Audit  Liaison)  at  (703) 
681-4360. 


S.  Ward  Casscells,  MD 


Attachment: 
As  stated 
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DoD  IG  DRAFT  REPORT 
D2008-D000LF-0100.00 

“TRICARE  Controls  Over  Claims  Submitted  by  Third-Party  Billing  Agencies” 
TRICARE  MANAGEMENT  ACTIVITY  COMMENTS 


RECOMMENDATIONS: 

TRICARE  recommends  that  the  Director,  TMA  strengthen  internal  controls  to  avoid  payment 
improper  health  care  claims  by: 

1 .  Identifying  relationships  between  providers  and  billing  agencies. 

2.  Ensuring  that  provider  addresses  are  not  those  of  billing  agencies. 

3.  Initiating  action  to  obtain  the  statutory  or  regulatory  authority  to  sanction  billings 
agencies  or  any  entities  that  prepare  or  submit  improper  health  care  claims  to  the 
TRICARE  contractors. 

TMA  RESPONSE: 

Recommendation  1  —  The  agency  will  study  the  internal  controls  currently  in  place  to  determine 
specific  weaknesses  as  they  relate  to  third  party  billing  agencies  and  will  identity  processes 
required  to  strengthen  those  areas.  TRICARE  anticipates  this  study  to  be  completed  no  later  than 
180  days  from  the  date  of  this  response. 

Recommendation  2  -  Upon  completion  of  the  study  referenced  above,  the  agency  will  determine 
the  best  approach  to  take  to  strengthen  our  internal  controls  over  payments  made  to  third  party 
billing  agencies. 

Recommendation  3  -  The  agency  will  review  this  recommendation  to  determine  the  necessity  of 
changing  the  regulatory  authority  to  sanction  billing  agencies.  TRICARE  anticipates  this  review 
to  be  completed  no  later  than  1 80  days  from  the  date  of  this  response. 
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